← Home

@vitessce/csv

npm Repository Homepage
74
Versions
MIT
License
No
Install Scripts
Attested
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation (unverified) npm registry signatures No source commit

Maintainers

keller-mark

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance slsa-provenance AI (provenance): Vitessce monorepo publishes via GitHub Actions with SLSA attestation; publisher-changed to GitHub Actions is expected for CI-based publishing. ai
provenance publisher-changed AI (provenance): Transition from keller-mark to GitHub Actions reflects a legitimate CI/CD migration for the vitessce monorepo, backed by SLSA attestation. ai
publish-pattern dormant-publish AI (publish-pattern): Dormancy followed by CI-based publishing with SLSA provenance is consistent with a legitimate release cadence change, not a takeover. ai
typosquat typosquat.levenshtein:qs AI (typosquat): Scoped @vitessce/ package in a known monorepo; cannot be a typosquat of 'qs'. ai
phantom-deps phantom-dep:@vitessce/constants-internal AI (phantom-deps): Same-org sibling dep in monorepo; phantom-dep heuristic unreliable here. ai
typosquat typosquat.levenshtein:ajv AI (typosquat): Scoped @vitessce/ package in a known monorepo; cannot be a typosquat of 'ajv'. ai
phantom-deps phantom-dep:d3-array AI (phantom-deps): Monorepo build artifact; d3-array may be used transitively or in config files. ai

Versions (showing 74 of 74)

Version Deps Published
4.0.1 7 / 0
4.0.0 7 / 0
3.9.11 7 / 0
3.9.10 7 / 0
3.9.9 7 / 0
3.9.8 7 / 0
3.9.7 7 / 0
3.9.6 7 / 0
3.9.5 7 / 0
3.9.4 7 / 0
3.9.3 7 / 0
3.9.2 7 / 0
3.9.1 7 / 0
3.9.0 7 / 0
3.8.13 7 / 0
3.8.10 7 / 0
3.8.9 7 / 0
3.8.8 7 / 0
3.8.7 7 / 0
3.8.6 7 / 0
3.8.5 7 / 0
3.8.4 7 / 0
3.8.3 7 / 0
3.8.2 7 / 0
3.8.1 7 / 0
3.8.0 7 / 0
3.7.1 7 / 0
3.7.0 7 / 0
3.6.18 7 / 0
3.6.17 7 / 0
3.6.16 7 / 0
3.6.15 7 / 0
3.6.14 7 / 0
3.6.13 7 / 0
3.6.12 7 / 0
3.6.11 7 / 0
3.6.10 7 / 0
3.6.9 7 / 0
3.6.8 7 / 0
3.6.7 6 / 0
3.6.6 6 / 0
3.6.5 6 / 0
3.6.4 6 / 0
3.6.3 6 / 0
3.6.2 6 / 0
3.6.1 6 / 0
3.6.0 6 / 0
3.5.12 6 / 0
3.5.11 6 / 0
3.5.10 6 / 0
3.5.9 6 / 0
3.5.8 6 / 0
3.5.7 6 / 0
3.5.6 6 / 0
3.5.5 6 / 0
3.5.4 6 / 0
3.5.3 6 / 0
3.5.2 6 / 0
3.5.1 6 / 0
3.5.0 6 / 0
3.4.14 6 / 0
3.4.12 6 / 0
3.4.11 6 / 0
3.4.10 6 / 0
3.4.9 6 / 0
3.4.8 6 / 0
3.4.7 6 / 0
3.4.6 6 / 0
3.4.5 6 / 0
3.4.4 6 / 0
3.4.3 6 / 0
3.4.2 6 / 0
3.4.1 6 / 0
3.4.0 6 / 0

v4.0.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.0.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.5.11

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.4.14

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.4.12

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.4.11

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.4.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.4.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.4.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.4.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.4.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.4.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.4.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.4.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.4.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.4.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.4.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.